President can order preemptive cyberattacks if needed

A secret review of American policies governing the use of cyberweapons has concluded that President Barack Obama has the broad power to order pre-emptive strikes on any country preparing to launch a major digital attack against the U.S.

The review is part of an ongoing effort by the Administration to develop new ground rules for U.S. engagement in cyberspace. Over the next few weeks the administration will work on approving rules for how the military can defend or retaliate against cyberattacks launched by unfriendly nation states, says a report in The New York Times.

The rules will also spell out how far U.S. intelligence agencies can go in looking for and mitigating imminent threats against U.S. assets in cyberspace, The Times reported, quoting unnamed sources. It would spell out situations where the military, with presidential approval, would be allowed to go out and preemptively inject destructive code on an adversary's networks, the report noted.

The order would also provide for exceptions where the military would be permitted to carry out preemptive cyberattacks of a tactical nature where executive approval would not be necessary

The highly classified rules have been under development for nearly two years and are apparently a response to growing concerns about crippling attacks against U.S. critical infrastructure targets by enemy states.

The new policies would continue to bar the military from defending domestic civilian targets against most cyberattacks, since that would be a task carried by the U.S. Department of Homeland Security. However, in the event of a major cyberattack the rules would allow the Pentagon to become involved. The threshold for what constitutes a major event will be deliberately kept shrouded to confound adversaries.

News of the administration's plans to develop new rules of engagement in cyberspace follows the recent disclosure that the Pentagon is planning on adding as many as 4,000 more troops and civilians to its Cyber Command. The goal of the planned staffing increase is to create three separate types of cyberforces each tasked with specific roles and responsibilities. The cyberforce structure will include Cyber National Mission Forces, Cyber Combat Mission Forces and Cyber Protection Forces, a military official said.

Together, the moves constitute a broad ranging effort by the government to come up with a strategic policy for dealing with online threats. The U.S. is already regarded as having a fairly aggressive posture in cyberspace. The Stuxnet attacks in 2010 that temporarily took out nearly one-fifth of the 5,000 centrifuges that Iran had operating at the Natanz nuclear facility for example is believed to be one example of a pre-emptive strike that has already taken place.

Though the U.S. government has never officially conceded to its role in the attack many with the government have anonymously admitted to its involvement in creating and deploying Stuxnet.

While many see the moves as vital to protecting American interests in cyberspace, others worry that the efforts at building an offensive capability are misdirected.

"Indeed, the Obama Administration has been so intent on responding to the cyber threat with martial aggression that it hasn't paused to consider the true nature of the threat," wrote Thomas Rid, a Reader in War Studies at King's College in London and a non-resident fellow at the School for Advanced International Studies at Johns Hopkins University.

"And that has lead to two crucial mistakes: first, failing to realize (or choosing to ignore) that offensive capabilities in cyber security don't translate easily into defensive capabilities. And second, failing to realize (or choosing to ignore) that it is far more urgent for the United States to concentrate on developing the latter, rather than the former," Rid wrote.

It is a position shared by others. "It does seem as though the U.S. is ramping up its offensive capabilities a hell of a lot more than preparing for defensive resiliency," wrote Daniel Drezner, a professor of international politics at Tufts University in a blog post Monday. "In an arena populated by non-state actors and quasi-non-state actors, defense would seem to me to be a far more important concern."p>

Top Whitepapers

More and more government agencies are turning to a BYOD strategy. While this can make more transactions mobile and potentially decrease IT costs, they may also make the agency vulnerable to security breaches.
•One of the biggest threats is social engineering, a process by which an adversary tricks the user into offering up information or access rights.
•While there are several types of social engineering to be on the lookout for, there are three dominant attacks to watch
•As agencies debate expanded device and data management policies, creating a divide between personal and professional content is essential

Featured Whitepapers

This whitepaper gives an overview of networks and applications, describes basic principles of web application optimization, and then examines the benefits and drawbacks of various acceleration techniques to ultimately improve web application performance.
•Most organisations want to improve web application performance for their users, but they can’t always justify the cost of implementing acceleration techniques
•A simplified web application acceleration solution that lowers the operational and commercial barriers and improves user experience is idea
•F5 offers a simple, low-risk, and low-cost acceleration solution that can significantly improve the end-user experience

Copyright 2015 IDG Communications. ABN 14 001 592 650. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.